Ledger Donjon extracts Trezor seeds in minutes with physical access

In July 2019 Ledger’s security team, Donjon, published research describing a physical attack that extracts the recovery seed from Trezor One and Trezor Model T devices, as well as KeepKey, B Wallet and other Trezor clones. Ledger states that it disclosed the attack to Trezor in December 2018; Trezor disputes this (see below).

Ledger withheld the technical details to limit exploitation. According to its post, the attack uses a low-cost board connected to a laptop, takes about 5 minutes (roughly 3 minutes of preparation and 2 of extraction), costs around $100 in equipment and succeeded on about 20 devices. On firmware that encrypts the seed (Trezor One 1.8 and later), the PIN must also be brute-forced, which Ledger says adds a few minutes. Ledger states the flaw cannot be patched and would require a complete hardware redesign.

Ledger says the only mitigation is a long passphrase and suggests about 37 random characters to match the strength of a 24-word seed. In its response of 11 July 2019, SatoshiLabs states that the attack had already been shown at the MIT Bitcoin Expo in March 2019, that it never received a description of this specific attack, its procedure or hardware from Ledger, and that publishing it without those details did not follow responsible disclosure. It argues the attack needs a tool whose design only Donjon knows and costly prior research, contrary to the $100 figure, and that it requires opening the device. Trezor states that a passphrase fully mitigates the attack because it is not stored on the device. Its CEO said the company had been aware of this class of attack since designing Trezor.